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Name Timestamp Value Input 
C) Apple Absolute Time (ns) (UTC) 06/04/2001 1:52 


Format | Numeric 
© Apple Absolute Time (ns) 06/04/2001 8:22 


© Chromium Time Microseconds (UTC) 11/08/2022 9:09 Value | 13312372172175276 
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© Windows Filetime 03/10/1643 2:36 No Adjustment 
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File Options Filter Report Tools Help 
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Time Converting UTC To MMT 
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Google Chrome isn't your default browser Set as default 


History Q._ Search history 


Chrome history : i “e Journeys 
Tabs from other devices 
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Clear browsing data 


Basic Advanced 
Time range Last hour 


Browsing history 
Clears history from all synced devices 


Cookies and other site data 


Signs you out of most sites. You'll stay signed in to your Google Account 


so your synced data can be cleared 
Cached images and files 


Frees up less than 11.4 MB. Some sites may load more slowly on your 
next visit 


Search history and other forms of activity may be saved in your Google 
Account when you're signed in. You can delete them anytime. ~ 


Cancel Clear data 
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Share View 
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Chrome Session Folder Location 
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Date modified 


Session_13312390685042752 11/8/2022 8:48 PM 
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Time Decoding Time Encoding 


Name Timestamp Value Input 


iC) Apple Absolute Time (ns) (UTC) Monday, 04 June 2001 01:53:10 
Format | Numeric 
(C) Apple Absolute Time (ns) Monday, 04 June 2001 08:23:10 


© Chromium Time Microseconds (UTC) Tuesday, 08 November 2022 14:18:05 Value 13312390685042752 


© Chromium Time Microseconds Tuesday, 08 November 2022 20:48:05 Decide 


iC) Microsoft Ticks (Local) Monday, 09 March 0043 20:37:48 


(C) Unix Microseconds (UTC) Friday, 08 November 2391 14:18:05 To wes 


© Unix Microseconds Friday, 08 November 2391 20:48:05 


© Windows Filetime (UTC) Monday, 09 March 1643 20:37:48 Name (UTC+06:30) Yangon (Rangoon) 


© Windows Filetime Tuesday, 10 March 1643 03:07:48 No Adjustment 


Date Output 


Pattern | dddd, dd MMMM yyyy HH:mmi:ss 


Sample Tuesday, 08 November 2022 20:24:09 
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Time Decoding Time Encoding 


Name 


© Apple Absolute Time (ns) (UTC) 


© Apple Absolute Time (ns) 


© Chromium Time Microseconds (UTC) 
© Chromium Time Microseconds 

© Microsoft Ticks (Local) 

© Unix Microseconds (UTC) 

© Unix Microseconds 

© Windows Filetime (UTC) 


© Windows Filetime 
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Monday, 04 June 2001 01:53:10 
Monday, 04 June 2001 08:23:10 
Tuesday, 08 November 2022 14:18:05 
Tuesday, 08 November 2022 20:48:05 
Monday, 09 March 0043 20:37:48 
Friday, 08 November 2391 14:18:05 
Friday, 08 November 2391 20:48:05 
Monday, 09 March 1643 20:37:48 


Tuesday, 10 March 1643 03:07:48 
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Value 13312390685042754 


Decode 


Time Zone 
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Cached Images 


Cached Web Pages Filter by date 


From: Select a date fis} 
Downloads 
Email Addresses H Select a date fis} 


Favicons 


Cookies 


Form History 
Filter by time 
Logins 


Searches From: Select a time 


Session Tabs 


To: Select a time 


Filter Keywords in BFE 


& Browser History Examiner 


File Options Filter Report Tools Help 
Artefact Session Tabs | Report Preview 


. Filter by keyword 
Bookmarks Last Visited Tab Last Accessed Session Last Updated Title URL nesey Renin 


| |os/11/2022 21:21:31 History |chrome://histary/ 

08/11/2022 21:21:33 Settings chrome://settings/clearBrowse! 
Cached Files 08/11/2022 21:21:39 Settings 
08/11/2022 21:21:31 History 
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Browser Settings 


Cached Web Pages Filter by date 


Cookies 
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Downloads 
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Favicons 


Form History 
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Logins 
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_ Session Tabs 
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Edge Browser, Opera Browser, Brave Browser 


Edge Browser, Opera Browser, Brave Browser are based on Open- 
Source Chromium Browser. So, Session Files and Tab File Structure are 


Same. 
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Edge Browser - Session Folder Location 


C:\Users\UserName\AppData\Local\Microsoft\Edge\UserData\Default\Sessions 


Opera Browser - Session Folder Location 


C:\Users\UserName\AppData\Roaming\Opera Software\Opera Stable\Sessions 


Brave Browser — Session Folder Location 


C:\Users\UserName\AppData\Local\BraveSoftware\BraveBrowser\UserData\Default\ 
Sessions 
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CLEAR BROWSING DATA FORENSICS 


Firefox Browser 


Clear All History 


Time range to clear: Everything 
All history will be cleared. 
This action cannot be undone. 


History 


@ Browsing & download history @ Cookies 


@ Active logins @ Cache 


@ Form & search history 


Data 


@ Site settings @ Offline website data 


i: 


Clear Everything in Firefox 
Clear Browsing Data and Not Use Firefox Browser 


Firefox Browser — Session Folder Location (JSONLZ4) 


C:\Users\UserName\AppData\Roaming\Mozilla\Firefox\Profiles\Profile.def 


ault-release\Sessionstore-backups 


C:\Users\UserName\AppData\Roaming\Mozilla\Firefox\Profiles\Profile.def 


ault-release\Sessionstore 
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: C(e Cc . . . 
go upgrade File edleonolonsi @jo5[Gses008 Profile 2 Previous, Sessionstore 


: Cc(e Cc je) C 
File edleonolonst @jo5Gsego05e0 recovery asdomedloss0los05u 


Paste 


board 


Name 


ie | previous 
ea upgrade.jsoniz4-20221104133228 


+ Copy path 


va x< 


isPC » Desktop » DelH » Profiles (Before History Delete) 


> 


k4eqcux8.default-release >» sessionstore-backups 


Date modified Type 


11/7/2022 11:01 PM JSONLZ4 File 
11/6/2022 5:01 PM JSONLZ4-2022110... 


=I 


Move Copy Delete Rename 


[a] Paste shortcut to to ~ 


Organize 


New 
folder 


Desktop > DelH » Profiles (After History Delete) 


Name 


> 


si} New item ~ Y| 54 Open eH Select all 


=] Easy access ~ Edit 


2 History Jo 


New Open 


Properties 


k4eqcux8.default-release >» sessionstore-backups 


Date modified Type 


Fy 
a recovery 


11/8/2022 9:39 PM JSONLZ4 File 


Profiles (Before History Delete) > 


Name 


] protections.sqlite 


search.json.mozlz4 


= _ 
serviceworker 


— . z = 
sessionCheckpoints.json 


shield-preference-ex periments.json 


x8.default-release 


ie =) 


we 


View 


Cut ~ ~x< 


Copy path 


k4eqcux8.default-release 


Date modified Type 
11/7/2022 11:01 PM SQLITE File 


11/6/ 


11/6/2 


11/8/2 


4: 
= 


2 8: 


50 PM MOZLZ4 File 


29 PM Text Document 


19 PM JSON File 


11/8/2022 8:19 PM JSONLZ4 File 
11/6/2022 4:49 PM JSON File 


=f 


» Move Copy Delete Rename 
[#] Paste shortcut to to ~ 


Organize 


protections.sqlite 


search.json.moziz4 


serviceworker 


sessionCheckpoints.json 


shield-preference-experiments.json 


signedinUser.json 


New 


folder 


New item ~ | J Open 
TZ Z| a 
=] Easy access ~ Edit 

Properties 
~ ra) History 


New Open 


k4eqcuxS8.default-release 


Date modified Type 


11/8/ 


VWs 


8 8 a 


60 


2022 9:44 PM JavaScript File 


{2022 9:39 PM SQLITE File 


/202 
(202 
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(2022 4:50 PM MOZLZ4 File 


Text Document 
JSON File 
JSON File 
JSON File 


Text Document 


Before and After Browsing History Delete 
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CLEAR BROWSING DATA FORENSICS 


After Clear Browsing History In Firefox Profile 
No - Previous, Sessionstore File and Upgrade File 


@jo5[Gsego08 Firefox Profile ), SessionStore-backup File oda Recovery File 


03 JSON Viewer §(a3e0q6 Last update Time oo @j0530330g|$03 6029 loud 


C:\Users\UserName\AppData\Roaming\Mozilla\Firefox\Profiles\Profile.def 


ault-release\SessiosStore-backups 


> version 
b> windows 
selectedWindow : 1 
_closedWindows 
4 session 
lastUpdate : 1667920170647 
startTime : 1667919936624 
recentCrashes : 0 


DCode v5.5 
File Tools Theme Help 


ime Decoding Time Encoding 


Name Timestamp Value Input 


© Apple Absolute Time (ns) (UTC) Monday, 01 January 2001 00:27:47 
Format Numeric 


© Apple Absolute Time (ns) Monday, 01 January 2001 06:57:47 


1667920170647 


© Chromium Time Microseconds (UTC) Saturday, 20 January 1601 07:18:40 Value 


© Chromium Time Microseconds Saturday, 20 January 1601 13:48:40 


Decode 


© Chromium Time Milliseconds (UTC) Saturday, 08 November 1653 15:09:30 


© Chromium Time Milliseconds Saturday, 08 November 1653 21:39:30 


Time Zone 


© Microsoft Ticks (Local) Tuesday, 02 January 0001 22:19:52 


© Unix Microseconds (UTC) 


© Unix Microseconds 


© Unix Milliseconds (Java Time) (UTC) 


> © Unix milliseconds (Java Time) 


Tuesday, 20 January 1970 07:18:40 
Tuesday, 20 January 1970 13:48:40 
Tuesday, 08 November 2022 15:09:30 


Tuesday, 08 November 20 


Name (UTC+06:30) Yangon (Rangoon) 


No Adjustment 


© Windows Filetime (UTC) Tuesday, 02 January 1601 22:19:52 


After Clear Browsing Data (Sessiosstore-backups — recovery File Last Update 


Time) 
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Clear Browsing Data and Use Firefox Browser Again 


Browsing History Data Bao5[Greg005 [g§copSs9032[4)3q6 Firefox 


Profile qd, Sessionstore File o> Time Update [gdcsorm3e02q400Ii 


C:\Users\UserName\AppData\Roaming\Mozilla\Firefox\Profiles\Profile.default- 


release\Sessionstore 


File 
4 JSON 
version 
windows 
selectedWindow : 0 
_closedWindows 
session 
startTime : 1667921466517 
recentCrashes : 0 
global 
cookies 
40 


host : addons.mozilla.org 

value : Wdeb979eee6a055f8b5ccb7582f647925bfa4790e5bae49206aad39dc93b5b73 
path: / 

name : taarld 

secure : True 

httponly : True 

expiry : 1667921467543 

originAttributes 

sameSite : 1 

schemeMap : 2 


host : .wikipedia.org 

value : MM:06:Yangon:16.78:96.18:v4 
path: / 

name : GeolP 

secure : True 

originAttributes 

schemeMap : 2 


Open Sessionstore File With JSON Viewer 
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Value Input 


© Apple Absolute Time (ns) (UTC) Monday, 01 January 2001 00:27:47 


Format Numeric 


| © Apple Absolute Time (ns) Monday, 01 January 2001 06:57:47 
| © Chromium Time Microseconds (UTC) | Saturday, 20 January 160107: 18:41 
| © Chromium Time Microseconds | Saturday, 20 January 1601 13:48:41 
| © Chromium Time Milliseconds (UTC) Saturday, 08 November 1653 15:32:06 


| © Chromium Time Milliseconds Saturday, 08 November 1653 22:02:06 


Value 1667921526529 


Tuesday, 02 January 0001 22:19:52 : 
Tuesday, 20 January 1970 07:18:41 (UTC+06:30) Yangon (Rangoon) 


Tuesday, 20 January 1970 13:48:41 No Adjustment 


Tuesday, 02 January 1601 22:19:52 


Pattern | dddd, dd MMMM yyyy HH:mmi:ss 


Wednesday, 03 January 1601 04:49:52 


Sample Tuesday, 08 November 2022 20:24:09 


Convert Time To Local Time With DCode 


Good Luck 
Aung Zaw Myo 


www.forensicsmyanma rcom 


REFERENCE 


Recovering Cleared Browser History - Chrome Forensics (inversecos.com 


17 


